FERPA, HIPAA & DPPA 


How federal privacy laws affect newsgathering 


Ate federal laws that control 


the information a state can disclose about its 
citizens are usually meant to protect individu- 
al privacy rights, but many open government 
experts say states are interpreting the laws too 
broadly and it is interfering with journalists’ 
newsgathering ability. 

The federal privacy protection laws — 
including the Family Educational Rights 
and Privacy Act (FERPA), which applies to 
student records; the Health Insurance Porta- 
bility and Accountability Act (HIPAA), which 
deals with health information and medical 
records; and the Driver’s Privacy Protection 
Act (DPPA), which deals with records kept 
by state departments of motor vehicles — can 


hinder reporters’ ability to obtain records 


under state freedom-of-information laws. 
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The Family Educational Rights 


and Privacy Act (FERPA) 


The Family Educational Rights and Privacy Act of 1974 is 
the federal law that protects the privacy of student education 
records and requires schools to obtain a student’s consent, or, 
for minor students, the consent of their guardian, prior to 
disclosing academic records. 

The law was aimed at protecting 
students’ grades and disciplinary records 
from public release, but according to the 
Society of Professional Journalists, it “has 
been twisted beyond recognition, keeping 
school lunch menus, graduation honors 
and athletic travel records secret.” 

In practice, the act is frequently abused 
to deny newsworthy open-records re- 
quests for information in which there is 
no legitimate privacy interest, said Frank 
LoMonte, executive director of the Stu- 
dent Press Law Center. “Because of the 
over-the-top way that schools and col- 
leges interpret FERPA, journalists have 
been denied access even to anonymous 
statistical information that’s necessary 
to perform their oversight function,” 
he said. 

LoMonte cites other extreme exam- 
ples, including practices at the University 
of Wisconsin-Milwaukee and Emporia 
State University in Kansas. Wisconsin 
“took FERPA literalism to new heights” 
when it withheld audiotapes and minutes 
of open, public committee meetings dur- 
ing which students spoke and voted, say- 
ing that the students’ voices were private 
information and Emporia claimed that 
campus parking tickets are were private 
under the act, LoMonte said. 

When Congress enacted FERPA dur- 
ing the 1970s, it was designed to protect 
student records from being released dur- 
ing a time when a substantial amount of 
social-science research was taking place in 
elementary and high schools. “The addi- 
tion of colleges to FERPA was very much 
an afterthought and some people in fact 
think it was a mistake,” LoMonte said. 

Still, at the time, the act was under- 
stood to apply only to educational records 
and not to every document that refers to a 
student. When courts have interpreted the law they have used 
this common-sense approach, but the Department of Educa- 
tion has been “openly defiant,” even enacting a rule effective 
in January 2009 that appears to directly contradict the courts’ 
interpretation that documents are no longer FERPA documents 
once student identities are removed, LoMonte said. 
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The new Department of Education regulations prevent the 
release of even anonymous information when those records are 
requested by someone the institution “reasonably believes” 
knows the identity of a student involved in the record. This 
new rule proves especially problematic for journalists because 
it hinders their ability to make a gen- 
eralized records request about a widely 
publicized campus incident when 
the names of involved students have 
already been made public. 

Because the law is vague and 
unclear, reporters say, even simple 
open-records requests are handled 
differently at different schools. A six- 
month investigation by the Columbus 
Dispatch in 2009 into how college 
athletic departments respond to public 
records requests found that branches 
of the same state college system had 
conflicting approaches to dealing with 
records requests. 

The results of the Columbus Dis- 
patch investigation “stunned” former 
U.S. Senator James Buckley, who 
crafted the legislation in the 1970s 
to keep report cards and transcripts 
private. Buckley told the newspaper 
he never intended for the law to apply 
to athletic records. “The law needs 
to be revamped. Institutions are put- 
ting their own meaning into the law,” 
Buckley said. 

Meaningful reform would hinge 
on getting rid of the “perception, fu- 
eled by a poorly drafted statute, that 
a school that slips up and mistakenly 
honors an open-records request will 
lose all of its federal money and be 
shut down,” LoMonte said. “In the 
36-year history of the statute, not one 
institution has ever been penalized one 
dime, and yet that perception persists.” 

LoMonte said the statutory defini- 
tion of what is an “education record” 
could also be tightened so that it is 
clear that a student’s parking tickets, 
job application or any other document 
that is generated in a non-academic 
capacity is not a FERPA record. “If the student is just doing 
something that any member of the general public could do, 
like getting a traffic ticket, then they’re not acting in their 
‘student’ capacity and there shouldn’t be two sets of disclosure 
rules just because one driver was lucky enough to register for 
a racquetball class,” he said. 
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Health Insurance Portability and 


Accountability Act CHIPAA) 


Congress passed the Health Insurance Portability and Ac- 
countability Act in 1996, which required the Department of 
Health and Human Services to enact federal health privacy 
regulations known as the Standards for Privacy of Individually 
Identifiable Health Information. Many media organizations, 
including The Reporters Committee for Freedom of the Press, 
the Newspaper Association of America, the National News- 
paper Association and the American Society of Newspaper 
Editors, objected that the proposed rule overly 
restricted access to information. Still, the law 
went into effect in 2003. Under the privacy rule, 
those who violate the law unintentionally can 
incur civil penalties of $100 per violation, up to 
a $25,000 annual maximum fine. For intentional 
violations and misuse of individually identifiable 
health information, criminal penalties can lead 
toa fine of up to $250,000 and imprisonment for 
up to 10 years. A safe harbor provision exists for 
inadvertent disclosures made by covered entities 
that exercise reasonable diligence in attempting 
to comply with the law. 

Even with safeguards to protect institutions 
that make a good-faith disclosure decision, jour- 
nalists say agencies withhold records that were 
never intended to be covered under HIPAA 
because they are unsure about the law — or 
use it as an excuse. 

“Reporters understand the need not to have 
private health information released willy-nilly,” 
said Charles Ornstein, a Pulitzer Prize-winning 
reporter for ProPublica in New York and presi- 
dent of the Association of Health Care Journal- 
ists. “The biggest problem, from my estimation, 
is that HIPAA is misapplied by hospitals and 
healthcare institutions.” 

Many hospitals, for example, refuse to 
release information even with the consent of 
the patient. When Ornstein was a reporter for 
the Los Angeles Times, he was assigned to cover 
the 2005 derailment of a train in Glendale, 
California, and wanted to talk with survivors 
in local hospitals. He found that the hospitals 
had a “radical difference” in willingness to help 
journalists. Some hospitals relied on HIPAA 
automatically, refusing even to let survivors know a reporter 
wanted to speak with them, while others arranged interviews and 
invited Ornstein and his photographer to approach the patients. 

“HIPAA doesn’t say you can’t ask the patient [for an inter- 
view], but a hospital that doesn’t want to cooperate just uses 
HIPAA as a shield,” Ornstein said. “It goes beyond issues of 
patient privacy. Some hospitals just don’t want to be in the 
media and will go to unbelievable lengths to say we’re not al- 
lowed in, when in fact it’s not that easy.” 

Exacerbating the problem are privacy breaches, including 
reports of nurses and doctors hacking into hospitals’ computers, 
illegally accessing their friends and family members’ records, 


and leaking celebrity patient medical records or financial in- 
formation to tabloids. Farrah Fawcett’s medical records, for 
instance, were leaked to the National Enquirer in 2007 when 
she received her cancer diagnosis. 

For that reason, hospitals are cracking down on both 
unintentional and intentional breaches, which makes sense 
to most journalists. “No reporter would argue with that,” 
Ornstein said. “It’s an issue of misusing HIPAA where no 
patient privacy applies.” 

According to the Department of 
Health and Human Services, HIPAA 
allows the release of hospital direc- 
tory information containing basic 
facts about current or recent patients 
treated by a hospital, unless the pa- 
tient objects. This includes patients’ 
names, locations within the hospital, 
general conditions, including whether 
a patient has been treated and released 
or has died, religious affiliations and 
room telephone numbers. However, 
despite these guidelines, many hospi- 
tals claim information is protected by 
HIPAA when it is not. 

One recent example of widespread 
HIPAA misapplication is the vast 
variation in how state and county 
health departments and government 
agencies provided information on the 
HIN1 flu and its related deaths. The 
Association of Health Care Journalists 
found that while HIPAA prevents the 
release of names of patients, when an 
HIN1-related death occurred, some 
hospitals were more forthcoming and 
released the age of the person who 
died and some underlying medical 
conditions, while others would go 
no further than to state a death had 
occurred. 

“Across the country, there can 
be an attitude of ‘big brother knows 
best,’ and ‘we know what information 
the public should know and we'll tell 
you what you need to know,” said Ornstein. “Unfortunately 
this attitude is not arming the public with the information to 
decide what the risk is and how to protect themselves.” 

Still, health institutions typically release hospital inspec- 
tion reports, Ornstein said, even when the reports include 
information relating to a specific patient that can be easily 
identified. For example, when Dennis Quaid’s newborn twins 
were among three children who received an overdose of the 
blood-thinner Heparin, an investigation took place and the 
inspection report was released, even though the public could 
surmise that “Patient A” and “Patient B” where Quaid’s chil- 
dren, Ornstein said. 
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The Driver’s Privacy Protection Act CDPPA) 


The Driver’s Privacy Protection Act was passed in 1994 
and amended in 1999 to require drivers’ consent before states 
can release personal information contained in an individual’s 
department of motor vehicles record, even when the informa- 
tion is requested en masse for a generalized marketing purpose. 

The protected privacy information includes all of the in- 
formation attached to a person’s driver’s license record and 
application, such as their name, address, telephone number, 
vehicle description, Social Security Number, driver identifica- 
tion number, photograph, height, weight, gender, age, driving- 
related medical conditions and fingerprints. The law does 
not, however, protect a driver’s traffic violations, accidents or 
current license status from release. Whether that information 
is available upon request depends on each individual state law 
and many state rules are more restrictive than 
the federal guidelines. 

Senator Barbara Boxer of California created 
DPPA in the wake of the murder of a famous 
actress whose stalker hired a private detective 
to find her address through state motor vehicle 
records. Ironically, the final version of the law 
carved out an exemption for licensed private 
investigators. 

The law has other exceptions, which some 
open government advocates argue swallow 
the rule. The protected personal information 
can still be accessed by any federal, state or 
local agency in order to carry out its govern- 
mental function, such as for law enforcement 
purposes and for use in proceedings involving 
automobiles — for instance, a recall of motor 
vehicles or an insurance claim investigation. 
The personal data can also be released if a re- 
quester can show the information will be used 
for automobile and driver safety purposes, the 
prevention of auto theft, or for market research 
activities. 

“The biggest irony of this bill is that it 
makes allowances for nearly every special inter- 
est group imaginable — from insurance compa- 
nies to direct marketers — but it bars access to 
the public, which pays to collect and maintain 
the information and which is supposed to 
benefit from collecting this information,” then 
Society of Professional Journalists Freedom of 
Information Committee Chairwoman Lucy Dalglish testified 
before the House Judiciary Committee when it was considering 
the legislation in 1994. 

“The only protection the public has against government 
incompetence is the ability to scrutinize these records. In a 
democratic society, the price of government accountability can 
sometimes be the loss of a small measure of privacy,” Dalglish 
testified on behalf of a coalition of journalism groups. 

Despite all the exemptions to the law, there is no provi- 
sion allowing journalists access to the data for newsgathering 
purposes and some lay the blame for the lack of a news-related 
exemption squarely on the shoulders of the news media indus- 
try, which fought the legislation but did not pursue a media 
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exemption. SPJ, for example, did not pursue the newsgather- 
ing exemption because “at the time, the leadership did not 
feel comfortable having rights above and beyond those of the 
general public,” said SPJ Executive Director Joe Skeel. 

“I thought it was a terrible idea at the time,” said Diane 
Kennedy, president of the New York News Publishers Associa- 
tion. By turning down a newsgathering exemption, the media 
industry essentially gave up the public’s only hope for access- 
ing important motor vehicle records through news reporting. 

The belief that journalists should always be treated the 
same as members of the public has evolved since 1994, said 
Skeel, who noted that SPJ recently pursued a federal shield 
law, which gives reporters more rights than ordinary citizens to 
resist subpoenas. “Now, if journalists don’t have special rights, 
it’s really going to hurt the public more in the 
long run,” he said. 

‘Though no newsgathering exemption ex- 
ists within the DPPA, reporters in some states 
are able to rely on various narrow interpreta- 
tions of the law in order to gain access to the 
records. In some states, journalists reporting 
on accident trends or similar issues can pursue 
disclosure under the driver safety exemption. 
New York, for example, maintains a database 
accessible to those who frequently need to gain 
access to driving records — such as towing 
operations, insurance companies, and credit 
bureaus — as well as anyone participating in 
market research activities. 

Until recently, New York journalists who 
believed their reporting fell under the research 
function could gain access to the database after 
signing an agreement promising to use the 
online lookup system only for research pur- 
poses. Every record search cost $7, with each 
newspaper running a few thousand searches 
per year. But in April, the state’s motor vehicles 
department began contacting newspapers 
to revoke database privileges, saying it had 
conducted an audit and determined that 
newsgathering was not a research function, 
even when used for public safety purposes or 
to illustrate driving trends. 

Kennedy said the Department of Motor 
Vehicles “has not been forthcoming with 
plausible reasons why” the audit was conducted in the first 
place and why its commissioner has refused to meet with news 
organizations to discuss the issue or clarify the problem. 

New York media organizations plan to write a formal letter 
to the DMV requesting to have their database access reinstated. 
At the very least, the media industry hopes the database can be 
retooled so that reporters who already have personal informa- 
tion can use the lookup to verify that they are writing about 
the correct person. 

“The public is deprived of knowing there are these danger- 
ous drivers out there,” Kennedy said. She illustrated the im- 
portance of motor records in reporting by citing a car accident 
in which a driver with a long history of reckless behavior hit a 
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mother and little girl. The police officer on the scene failed to 
run the driver’s license or issue a citation, but a reporter used 
the database to look up the driver’s information. As a result of 
the reporter’s story, the driver’s license was revoked. 

“I believe the DPPA was passed as part of a knee 
jerk reaction to something that was not based in real- 
ity,” said Robert J. Freeman, the executive director of 
the Committee on Open Government in New York. 
Part of the problem, Freeman said, is that there are too many 
privacy laws, and they are not consistent. Voting records, for 
example, are public and contain the same information expressly 
made private by the DPPA. Freeman called the law an “aberra- 
tion” because there is a vast societal distinction between when 
it was enacted, and now, when people freely publish the very 
information protected by the act on Facebook, online phone 
books and other message boards. 

“There are numerous sources of that information, but 
Congress, in its overreaction, decided to limit that informa- 
tion which historically has been open,” Freeman said. “There 
are innumerable situations involving government officials in 
which it is in the pubic interest to have access to the kind of 
information shut off by the DPPA.” 

Unlike FERPA, however, there is no easy legislative fix for 
DPPA. Congress likely will not act to remove privacy protec- 


tions already in place, since the media industry already gave up 
their opportunity for a newsgathering exemption. “I think we 
kind of missed the boat on that,” said Kennedy. 

At least one state, however, has succeeded in creating a 
legislative recognition of journalists’ right to obtain records 
under the DPPA exemption for the promotion of highway and 
vehicle safety. In Minnesota, the head of the state Driver and 
Vehicle Services testified to her belief that the DPPA safety 
exemption clearly encompasses journalists. 

“Since the inception of DPPA, we have had an agreement 
with the state Driver and Vehicle Services to get the data we 
used to get, but under a use agreement,” said Minneapolis at- 
torney Mark Anfinson, who represents the Minnesota News- 
paper Association. “It’s been consistently a good arrangement.” 

Still, Anfinson says just this past year, the department has been 
asking news organizations to provide more information on the 
intended use of drivers’ records. Anfinson said that will not be a 
problem for reporters, since “it is so easy for any news organi- 
zation to itemize the important public uses this data is put to.” 

He points to a recent example in which a local ABC affili- 
ate used the data to document that a small community had 77 
driver’s licenses issued under the same name and birth date 
and, as a result, the state investigated the scam and revoked 
all the licenses. 


Comparing the federal privacy laws 


Unlike with FERPA, reporters aren’t calling for a con- 
gressional “fix” of HIPAA. Since the real issue appears to be 
misinterpretation and misapplication of the law, Ornstein said 
health facilities need further education and retraining about 
what HIPAA does and does not do. 

But LoMonte said FERPA and HIPAA have some troubling 
similarities. “In both cases there are widespread misperceptions 
about what is and isn’t covered, and the cultural norm has 
become, when in doubt, to disclose nothing,” LoMonte said. 

Even though HIPAA only applies to disclosures by health 
care providers and health insurers, “the idea has become stuck 
in the general public’s heads that anything referring to some- 
one’s health is confidential,” said LoMonte, who has heard of 
photographers being banned from taking a picture of an athlete’s 
leg being taped up in the locker room because the school thinks 
that violates HIPAA. Still, LoMonte said the frequency of those 
misinterpretations “really pales in comparison” to FERPA. 

While both FERPA and HIPAA are frequently misapplied, 
the DPPA leaves less room for misinterpretation. “The DPPA 
is so laser-focused on driver license and registration records, 
there’s less room for subjective judgment calls,” LoMonte said. 
“We rarely hear of someone being falsely told that a record is 


secret under DPPA. If DPPA was invoked, unlike FERPA, it’s 
usually because DPPA actually does apply.” 

Both FERPA — with its roots in protecting schoolchildren 
from embarrassment based on 1970s social science research — 
and DPPA, which many argue is obsolete in the information-age 
of the Internet, protect against harms that some see as only a 
theoretical risk. HIPAA, on the other hand, stems from the 
widespread and current abuse of patient health information. 

“The issue of hacking into financial, insurance and health 
information by doctors and nurses who should know better is 
very real and that shouldn’t happen,” Ornstein said. When in- 
stitutions are faced with these legitimate concerns about privacy, 
they are often more likely to err on the side of nondisclosure, 
which makes journalists’ newsgathering especially difficult. 

“What all three statutes also have in common is that they 
have generated such a pervasive fear of the results of non- 
compliance that impacted institutions would much rather 
risk a suit under the relevant public records statute than to 
disclose information covered by either of the three statutes,” 
Harry Hammitt, vice president of the Virginia Coalition for 
Open Government, wrote in a report on federal controls of 
information disclosure. 
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